The Simple Restrict WordPress plugin prior to version 1.2.9 does not enforce its own content‑restriction permission check on the REST API; instead it only performs a generic capability check. Consequently, users with the contributor role or higher can request restricted posts or pages through the REST API and receive their full content. This exposes sensitive material that should only be available to higher‑level users, representing an improper access control flaw and a permissions oversight (CWE‑863). The vulnerability does not provide code execution or privilege escalation and is limited to content disclosure.

Any WordPress site that has installed the Simple Restrict plugin at a version older than 1.2.9 is affected. Because the flaw resides in the plugin’s core code, the issue exists regardless of other server or CMS configuration.

An attacker only needs to be authenticated with contributor or higher privileges to perform the exploit by sending REST API requests to the plugin’s endpoints. The EPSS score is below 1 %, indicating a low but non‑zero probability of exploitation, and the CVSS score of 2.7 reflects low severity. The vulnerability is not listed in CISA’s KEV catalogue, and no local privilege escalation or code‑execution path exists. Based on the description, it is inferred that the likely attack vector involves authenticated REST API calls to the plugin’s routes.